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mm&i mmm 

S*«©K3R^e>**^fnTi*J:©#3S^«:Mv^Tffi*y=f k (x) zmmL 

fMrT"«*W»S (x) lCoV^^#>&#)£*i£:Axlc*fl, (S (x) +S ( 
x + Ax) ) r y i:cD^«^ l tfes x©^l: 2 

mm. 

Mff^RffcS (x) ICOVNT, ^#>&#>e>*l£Ax, AylC^fLS (x) 
+ S (x+Ax) = Ay*m?xO&*&&TmfrMMmzttiT2>M&$:mffi-t 

ffffif *<-g«jK-fc-o v*T^g) Air x- £ -ecftv;* ^-ffl-P-x-®-|^-g|-^-Wgmt-3trll- 
S (x) t-e©7X^ir y £©P>J«#^L<&5xCDffc£ 2mVf^mt. 2 n 
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©g|^*^e)^;S^^T#:Jb©#^$:M^^Tffi^;y = f k (x) $:^IT, _t 

±ffi«*B8»S (x) lCo^T^#)&#>£*lfcAxK:*fb (S (x) +S (x 
+ Ax) ) Hmj3<D*?*#mr y fc©ft*#lT*&5x©»<&2#Lfcffii:2 n 
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m&miztt-tzm&zmffitzM&wm&mt. 

Si:. 

5: 3 y fcf a - # \Z £ y Hff $ i*5 ^ □ 9 A 5: IEIS L sBHWfco 

*l*H8*iW8CS (x) {CoV%T, ^#>&#>e>*l2i:Ax, Ay{C*fLS 

(x) +s (x + ax) = a y *m^x<Dmz&#>rm%-mwtmzM'tz>w&$: 

2 n t&mz&tbT. mmmmmizM-t^m^mm-t^mmmmm^wmm 
^amvommmms (x) iz^>^x ^&^«?> a xizmo (s ( X > + 

S (x + Ax) ) £ffi;fr<D^;**1Bry £©ft^aUl?&5x<D|&£2#Lfc'fiI 

£2 n (niix^tfy hm t&mz&toTmftmmxmmzft-tzw&zmffi 
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*%mm<DmmfrZte&%uTW±<Dg'Tg#,zm^Tmjjy = f k (x) 

[0 00 1] 

o 

[0 0 0 2] 
[0 0 0 3] 

& b^M 3 £tc<fcy £^#>T^£ 0 30, yUK&VAHRfcFW 

[0 0 0 4] 
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mwntt-oT^Zo mmz. s-b o x^m^-r^mz. &±&<d&m£lt. 

Mx.lt. m^tl>fc'r-&(D&¥ V h<D0, l<D&mm^tf%iMtmzi/2 £& 
[0 0 0 5] 

I$Ci£ rE.Biham , A.Shamir: "Differential Cryptanalysis of DES-like Crypt 
osystems, " Journal of Cryptology , Vol.4, No. 1, pp. 3-72J T?, ti&l&M 
S^iStfSCiK rM.Matsui : "Linear Cryptanalysis Method for DES Cipher, ." Ad 
vances in Cryptology— EUROCRYPT' 93 (Lecture Notes in Computer Science 76 
5), pp. 386-397, Springer-Verlag , 1994) T^^tl, # < <D^U y ^Bf 

[0 0 0 6] 

Sc^ttJC-OV^Tj fgl 8ia«#3iaH:-f<Z)|SfflS/>jKS?^A^ttJ|| (C-2-5 
) , pp. 175-178 j (JgJlT TSITA 95-C-2-5 j £\&?) T?S3g3ftfc. 3*1 (2 

[0 0 0 7] 

It&ofe. XftWfcWU SCW TT.Jakobsen, L.R.Knudsen : "The Interpolat 
ion Attack on Block Cipher, " Fast Software Encryption Workshop (FSE4) ( 
Lecture Notes in Computer Science 1267) , pp. 28-40, Springer Verlag,1997 
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Bt # x* , ws&ft&m'pmtsi&m iz^^xmm^n^m^^>^z\tf)'^ti 

[0 0 0 8] 

$ ZlZ^mmft&m^nm&m&sftlZ^JiWi rc.Harpes, J.L.Massey: "Part 
itioning Cryptanalysis, " Fast Software Encryption Workshop (FSE4) (Lect 
ure Notes in Computer Scinece 1267) , pp. 13-27, Springer Verlag , 1997J 

[0 0 0 9] 

mmifimvk i> «fc e» 1 1 zmmi 

^<Dmj&mzmisTm\LLT\,^z>(DizttLT. nm&&*M* mm^xm. 
mizMvx^izm^^^zr.t^mt^mitmm^X'^miLLx^^\ 
-?*t>*>. f%^tfz\tib<n&miztti,x&£x&z>fc#>iz^>#2±Mm. 
ss-b oxi$mt^^%<&m+ft0zfti*w%mz&^x\t\&^ e 

[0 0 10] 

L^U S-b ox$:mft-rs_hT% ZtibV&mmzttlsX 

fit, zi(Z)3§f9!©-gi&«\ JtSB<z>&#^&lc*fU ^©^VjStc^-rssa 
£i:«<W;bSig««:livxfflU *©|g*# LT&v^i: fcfcfflE?- 

fr&a*U ^tie»©— 9J*fcH:^T(Z)*#*»fe-rj:^3{fcS-b o xffHff$gtt& 

[0 0 11] 

£ g>{C, --£-<P%g|g)te®.B»J*3*^ 
tt £ * © :/ n ^ 9 A fB#P& # £ m m * Z> Z\ £ IZ $> 2> . 
[0 0 12] 

£i#EJC<fcfttf r «l8r««l& tc*rt*3&K 
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[0 0 13] 

#£3£^£o Jg*TT-«n, m*&M<D&f%®.£V, S-box (7>^Ht) 
£bTnb?*/ hA*, m\?y hffi^GDWffcS : G F (2) n — G F (2) m 
o GF(2) n \$±X<D-n\?y h r - * <D$k& Zm~t . 
[0 0 14] 

mftmmm test & ©is & % -d ^ «> 

s-box &Mi&Mnmztt-tz>w& : kxk-*m%k£ hxmft&mmmzfemv 
m$-Mm&T-te. s-box©2 ^><DAjj<Dmfr (Axm-frm) iztt-t&m±i 

(Dmft (ffi;fcrM3Ht) 1:11b, ^c^^U^feS^lc. ZLti*mmVxm^ 
[0 0 15] 

S-box0A*?:x, AMM&Ax, tt}*iM5:Ayi:t5i:, 
A^M4>fiiAxi:, ffi;frM:SHfiAy ICMLT, ^Ttf)nfc?<y hA^JxCD^**, 5£ 

(1) &^fe^x©MfS:$: 8 S (Ax, Ay) i:tS„ {BL, " + " ttfcf 

V h#©#Mffif$l&3SjftJ (XOR) -e^^$tl^)o £itK Tx.Lai, J.L.Massey, and 

S. Murphy. "Markov Ciphers and Differential Cryptanalysis." In D.W.Davies 
, editor, Advances in Crypto 1 ogy-EUROCRYPT -' 91 , Volume -547 of- Lecture No 



tes in Computer Science, pp. 17-38. Springer-Verlag, Berlin, Heidelberg, 
New York, 1991J X^ tlT £ o IC, -m&&mfctf%>Z>Zimmn i km^ 

[0 0 16] 
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S (x) +S (x + Ax) =Ay (1) 
ZtlZiWg&Z-ZtL. 8 S (Ax, Ay) (2) 0) J: r> JC»rjS. -fib. # 

{x|^} »^^ifctx©lli:t5 0 

6 C (Ax, Ay) =# (x£GF(2) n | (S(x) + S(x + Ax)) = Ay (2) 
AJl^frmH LTO £|&<:£T©nlf >y hr-^ AxiiffiM^f i: bt^t© 
mbfy h-r-# AylCfcfLT. 5£ (2) <k U 8 s (Ax, Ay) feSf-ft-* £ It 

Zl © 5 t3«=& * £ V ^ £ h £ A x £: A y ©M^i*#il#8¥M&tc £ 
3 BI3§,£ 8 S (Ax, Ay) ©^«VJn$ V>{$ifM^^tCM 

i-£K1£#:*:£V>£V^ ZlillCfcSo ±ot^ (3) T*^$*l5^#8¥SBfgg£A 

s $ v * z n t>mfrmmm ic *f l r w« £ %» o r=. «> © &n3i# & § . 

[001 7] 

A s =max 8 S (Ax, Ay) (3) 
[001 8] 

nmmwc&xiz. s-bo x©A2rttfcffl#it<z>fcf* h#&T?©£E«cDi»jgfn 

^^A^vx^^irxiim^^x^iiir y ic^ut, 5£ (4) t*j£^£*is ;i s 
(rx, ry) tfmW-xgZo fiu "•" ttrtflrejeiistis. x • r 

x(Z)Si*ii. T^^irxifi© "o" ic^jst-Sx#©tf y hMi±&mu "1 

„ -r&fc>*>. x • rx = Exj (s^r xt^co^i tf^/ h# "i" ©ife&fn) #b 

x= ( x n -l,*" x 0 ^ 
[0 0 19] 

a s (rx, ry) 
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= | 2 X # {.xGGF(2) " | x • Tx=S(x) • Ty} - 2 n | (4) 
£T©mfc?y h-^-* T ylC*fLT, z£ (4) J;*J^ S (Tx, Ty) ^tUTf 

K&vz>m&&l:te2>tzisb. i s (rx, r y ) ©«*ffi*«/hSv^^jiR^«i» 

[0 0 2 0] 

A s =max ^ s (rx, Ty) (5) 
maxlirx, r y * 0 <D±T<DM&iDl£<D&frt>m*m%:m&£^Z)2kft£ 

[00 2 1] 

mmmft&mmti*. m^tm^<D^mm^^A±nzm^xmmm^^£^£ 

^f-^rottiffl^yMi, x^izm-t^-^-jv^m^xmrnx^^. -e©^- 
^M^oM^dt^ofen, d + 1 mm&zt&t. ■z<z>mmzmiz&t>& 

»««t&fi^:ttA*C*^StlTV^S 0 

[0 0 2 2] 

]K^. iot, FR|&tf>^Mi}i-e&£ S - b o x0^-;i/#5^©Mt) 

*f b T Sc^ K -T £ £ <D &£ ^ # h V ^ x. 5 . 
[0 0 2 3] 
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S-boxS:GF (2) n -*GF ( 2 ) m ;x-»S (x) lC*fU 
y = S (x) , 

x= (x H , x n _ 2 , x Q ) 6GF (2) n , 

y= (y,,-! » y n _2 » -> y 0 ) ggf (2) m 
£i-£ 0 ^£fcffe£-x = {x^ , x n _ 2 , •», x 0 } Zfem-f r©B# 

„ yj =Sj (x) &Z>zr-;vm%lS j : GF (2) n -GF (2) ; x-»Sj 

(x) mmmatxizmi-zzr-Kmmis i co< i<m- 1 ) 

£ deg x Sj i:1"S 0 J£TF<Z><fce> £ deg x Sj (0<i<m-l) ©^/J^Srcle 

g x si:u rii^MiMiiit^s. 

[0 0 24] 

deg x S = m i n ( deg x S j ) ( 6 ) 

minttO<i<m-l^ffiltS 
TgVgm&&miZttLT&±T*2b2>fclsblZS-b o x jWSfc-r^i&g&frtt, d 
eg x s#*iv^£=fe>o;ii:-e&5o S^^WTfl&ntf, deg x s©g^:M« 
n - 1 -e&£z:i:#fcie>*iT^£>o 
* icMf 5 Wtt =fc o fe to © 

S-b o x©»|ffl*»SK:»r*©tt&^r»*^UT«W*«l#B«S:)e«IL/ 

[0 0 2 5] 

OV>Ttf)GF (q) _h#*£f k (x) &Mv^y=f k (x) tm^ZLHtfT* 
IS. {BU qtt^*^«^|S[<Z)^im^feS 0 f k (x) C^tlSxlCo 
V^©^ffc#cT*&£B£, cm<D¥JC£. s £MZtt-?2>V£^J:<Dm (xj , 

yi ) (l<i<c) tfJ3-jl*>titi&. 5if^>i?3Lmm&iS,teiflZJ:y, f k 
(x) fejgj&rs ~ £#T*g-£a -£*lK:J: M> frS<Z)^-x-K^i-5Bgr#^^-# 

[0 0 2 6] 

f k (x) tC^SflS^Btf^Kif, GF (q) _t#£5S#S3Bf k (x) 5: 
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s-box©GF (q) ±^m^mm^tn^m.WLt>^p^t:. 
gf (q> ±&m&mmz^£ft&mmtf&& B =fc*>5A>, 

S-boxOGF (q) ±#^^lC-^*tl§^Ut^#<T=fo, m^faZm 

t&u. s- b o xomm&m&mtLTitGF (q) ±&m&$&nz-&&ti& 

ox©RiS:s©GF (q) _t#^^lc^£;ft£3C&£ coeff q S£U dtl 
[0 0 2 7] 

§^<#<0GF (q) ±&m7%$tmzft LT-eo^fJt coeff q S&ffJfU ^ 
ic *f -t & Wtt 5: % -d tz. #> <Z)&£&# 

[0 0 2 8] 

Tli, rc.Harpes, J.L.Massey: "Partitioning Cryptanalysis, " Fast S 
oftware Encryption Workshop (FSE4) (Lecture Notes in Computer Science 12 
67) , pp. 13-27, Springer Verlag,1997j T&peak imba lancet squared Euclid 
ean imbalance 0jf£ btj if^tl X V ^ -• 



[0 0 2 9] 

mm &, mm m, tde smni-ic^f-rspart 

itioning cryptanalysis of DES J , 1 9 9 8 ^B|p# ^-ff^-fe U -r >f 
S^i^aM** (SCI S' 98-2. 2. A) j lc£v>T. S - b o x <D Amj]M&iZM HI 



1 1 
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[0 0 3 0] 

S-b o x<D±XJim€i*: g#«U #SPiMfe£-£F 0 , F x , F^ , 

ft2>mmmiz±Tmis^£-t2>o x±^^m^m^<D^ <o, 1, q - 
1} izimm'tzMMfZAtKDftmmm.. mxy* {o, i, m-u ^ 
**r & mm s z w^s, o * y x # * ©«p#j*&jcjn-r * ^ 

f, G*-t>i-r*i 

F= {F 0 , Fj , F q ^ } , 

G= {G 0 , G 1 , G H } 

il-TSil, S - b o x <D#tJ*f (F, G) 0>«UI s ( (F, G) ) (7) 

e>*l£o 
[0 0 3 1] 

I s ((F, G)) = (l/q) E i=0 q_1 I (g (S(x)) | f (x) = i) (7) 

7£lC, ^2^^lCOV>T^^So iSCiR ri.Jakobsen, L.R.Knudsen: "The Inte 
rpolation Attack on Block Cipher, " Fast Software Encryption Workshop (FS 
E4) (Lecture Notes in Computer Science 1267) , pp. 28-40, Springer Verla 

g, i997j T*mifbftT^z>miz&y. m^mmm^mmmmzM-r^mm^ 
&w&^mm&m&te £<Dttm&mmz £ y &«tc jim^ *i* r t ot^ 

So iot, ^2^^<DHJgMtt^^^^«PM^lc*f-r§Wffi^ : boK 
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[0 0 3 2] 

S-boxRtf (^>**Ai£fNilli) ©Mi:lt, M^ttf, Bg#fbb 
fc^-*©^ y h©0, lcDffi^^^ff^tc 1/2 i:^sggcD3i:b^ 

[0 0 3 3] 

[0 0 3 4] 



miizz\<D%miz&z>7y#2±mm:£.mmn. w»©9>*rM£swii£*©2g 

MM&mmWfc aVT . A±#J£ 1 \z «fc »J L «fc 5 1* £ K$c<D % £ £ 
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iz jfi; £ r~mffiMmtf£.f& £ *u -t © A ^ ^ - # M £: A^jM £ r *i £> ic % i; 

#«8. ■e©ffi©*B*»fli^«9 7?-t*i-rnwttWflir, jg*Mff&i?#&s*i* 

[0 0 3 5] 

tlS^^ret5£*\ £-3MS4~9lCA;ft£;ftT, 9>^AttWfllf3^fft>tlS. 

^CD-SfeSfiflttfWU #M¥l 0-0 1 3 5 7 2'7 r -^^g|^ficfi©S- b oxt 
UTM^S 8 y h Affi*© S - b o x ©igff&lCo^TM^So 

^-r. s-b oxLOfcffimmnisT. mz-itm 2 iz^-t^oizmmp (x, e 

) ^tS#^2 1i:, P (x, c) t^R^atfe^tCi-SMRA (y, a, 
b) ££/&^§#m2 2 £#^j&$;ftfefc<z>£:-t£ 0 

[0 0 3 6] 

S:GF (2) 8 -»GF (2) 8 ; x — A ((P(x, e)), a, b), 

P (x, e) =x e in GF (2 8 ) (8) 
A(y, a, b)=ay + b (mod 2 8 ) (9) 
T'&So P (x, e) ii^D7{*GF (2 8 ) ±T*j£^£*l3^£liiBI£rC*&£ 
. 3(Z)Bf, A^*-#a, b, e«0J£U:2 5 5 J£TF©tt;l:<Z> S^ifc^ e> B ft 
mtf&Z>o Z.Q>r>%. A^*-#a, btf>/\$ >yfi#£ 3 J£*_t 5 SATlC&gJtb 
, o*|)a, bte£-8 If y hT?&£#^-(Z>e>*> " 1" (X& "0" ) #3 Vf y h 

j£t_fc 5 tr y- h -AtT^e & ^ e> tc s - b o jta*-- ? & & 3 fe,-jg^-»»fe- 

o 

[0 0 3 7] 
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e #2 8 - 1 = 2 5 5 £3LwzmT*2bz>m. mmsit±mMiz 

tf> 2* £ a ± -r s r t x*m Z> . 

[0 0 3 8] 

e<D/\$y*fm&£:7S; (6) T***>-ft*«ieil##*Jt* deg x s£#*bv^ 
[0 0 3 9] 

^y^S4Tf«y<Z>«l»M«SCD»^^|g«A s ©*#&»fc*-fc«>, SB 
[0 0 4 0] 

L (Axr Ty) - — - — ■ 

= |2X# (xGGF (2) 8 | (S(x) + S(x+Ax)) • r y =l} -2 8 | 
E s =max j s (Ax, T y) 

max&Ax^O, r y * 0 ©£*B^;b1*©*;fr e>**ft&»4S£ V* 
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k & nJt^T© LfcB#\ 
[0 04 1] 

[an 

S : G F ( 2 ) n — *G F ( 2 ) " : x^x ! "in GF (2 n K 
^:ttS:GF (2) B ^GF (2)" :x^ t% ' in GF(2 n )Ol^. 

[0 0 4 2] 

(a, b) = (97,97), (97,225) , (225,97) , (225,225) 
e = 127,191,223,239,247,251,253,254 

mz. ^fy^sefsycm mms<D&mmm&i s ( (f, o ) 
m&.mmmi s ( (f, o ) au/2}csv^£?e>^&5tigi-£o 1/2 

[0 0 4 3] 

*^V7S 7T*3€{C^U©^ffiB5tS:S©GF (2 8 ) jt©#^£fijm-rs*i 
R&ffffi* coeff q S (fei£lq = 2 8 ) tf>£:#£?i£i-fc#>, _LfH^:7* - # 
©£T©M*^foi*0>e>l5>, HffcS<Z)GF (2 8 ) ' Jt©#£*fc5flJffli-S»H# 

gtfg® coeff q s#*£v^ife>fr£56§gi--So /jN£v^©#&*U;£#ra^£i& 
<■> 

[0 0 4 4] 

^-y^S 8 T«te, 2 8 + l-J^±2- 9 --^T<P^T-g)3K « p-tC-o-VvTT-8 B« S-g>- 



GF (p) ±CD#^&3pJ«-r6»ra***g« coeff p S 

Wms©GF (p) ±©#Jg^&frjffi1-*SW#»g« coeffp S#*£V%#£ 
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[0 0 4 5] 

£k±<D^ma>mm. #Ttf>A^;*-#©2g»-£fc-fr (^3 2li) ^S. 
(a, b) = (97, 97), (97 ,225), (225, 97), (225, 225) 
e = 127,191,223,239,247,251,253,254 

[0 0 4 6] 

s-b o x©fii:it, xitmm&mzis^T, mmtmA-tfmmmznw. 
*(Dm&z$tiz>^> #2*&(Dnm. v &m<o#;miztt~?z>&zizfavx&m 

[0 0 4 7] 

[#8f80D£&JH] 

. m#mmm. mm*m&. ismm^mm. mm&m&i. &m&mm. torn 
mm. s ti & gttt&ic *j~r & wis & % o ^ e> ^fpffit- & & ^ 

[0 0 4 8] 
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[0 0 4 9] 

mmmz^mm<Dm&&fri£fr*>m&z.iiT^ s- b o x ^ kt cm 

[0®<z>fS#fcI89n 
[01] 

[02] 
[03] 
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mm&i mm 

[Hi] 



[02] 




-4 


^5 


,6 








/8 




r9 


























[2] 1 



X-h 





P(x,e) 








f 




A(y, 


a, b) 



21 



,22 



1 



msE#^i i 
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[03] 



i 



0 £ a.b<256 
3 % W h (a) £ 5 
3 £ W h (b) £ 5 
0 ^ e <256 





a : 3?a& 

e : (2S5.b)=1 



^-S2 




W h {e)-7 

(a,b)-((97.97),{97.225} f (225.97),(225.22S)) 




257 £ p ^512 



W h (e)=7 

(a,b)"((97.97),(97.225).(225.97),(22S.225)) 



3 - 



2 
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mm) 

im&^m S=A ( (P (x, e) ) , a, b) , P (x, e) =x e inG 
F (2 8 ) , A (y, a, b) =a y + b (mod 2 8 ) *mW£ La, b©/\i* 
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